integ: land 2 clean-mergeable branches from backlog

contracts/sourceos/model-catalog-entry.v0.1.ts

@@ -8,12 +8,24 @@
  *  - Anthropic Claude Code / OpenAI Codex (forensic, 2026-06-10): versioned bundle delivery
  *    done well, lifecycle GC done badly (version accumulation, orphan LaunchServices rows),
  *    capability surface gated by runtime prompt rather than declared + policy-admitted.
+ *  - ChatGPT client (forensic, 2026-06-10): egress fans out through a first-party /ces gateway
+ *    to Statsig + Datadog before first frame, undeclared to the user; sentinel gates the send
+ *    path via chat-requirements/{prepare,finalize} before model IO, silently.
  *  - SourceOS differentiators: SAE interpretability, guardrail-fabric policy-as-code,
  *    Ontogenesis ontologies, SCOPE-D epistemic labeling, TriTRPC provenance wire,
  *    no-invisible-authority (everything declared, nothing discovered at runtime).
  *
  * Invariant: a model-router MUST refuse to admit or load an entry that fails
  * attestation, hash, capability-policy, or epistemic-label checks. Admission is the gate.
+ *
+ * v0.1 → v0.2 additions:
+ *  - EgressManifest with per-target permittedPhases (plugs the bootstrap-egress gap)
+ *  - ObservabilitySurface with sinkInitializesBeforeIO and gatedBeforeIO (plugs silent-init gap)
+ *  - ModelCatalogEntry.observability and .egress (both required)
+ *  - AdmissionDenialReason: egress_target_not_permitted, observability_sink_uninitialized,
+ *    cluster_not_admitted
+ *  - AdmissionResult.clusterAdmissionRef: Triune admission-pack cross-reference
+ *  - BaseBinding.baseModelId now optional for kind="base" entries (fixes TS validity)
  */
 
 // ── Enumerations ────────────────────────────────────────────────────────────
@@ -40,11 +52,21 @@ export type EpistemicLevel =
 /** Transport wire. TriTRPC is the SourceOS default (AEAD, byte-exact, ternary-native). */
 export type CarryWire = "tritrpc" | "https-fallback";
 
+/**
+ * Execution phase during which a network target may be contacted.
+ * Declaring permittedPhases per target prevents the bootstrap-egress pattern
+ * (ChatGPT forensic: telemetry fires before the first user frame).
+ */
+export type ExecutionPhase = "bootstrap" | "inference" | "shutdown";
+
 // ── Sub-records ─────────────────────────────────────────────────────────────
 
-/** Exact base-version binding. Forces adapter re-delivery on base change (Apple discipline). */
+/**
+ * Exact base-version binding. Forces adapter re-delivery on base change (Apple discipline).
+ * baseModelId is optional for kind="base" entries (a base IS its own binding).
+ */
 export interface BaseBinding {
-  baseModelId: string;          // e.g. "sourceos.base.v3"
+  baseModelId?: string;         // required for adapter/steering/guardrail; omit for base
   baseVersion: string;          // exact semver; adapter is INVALID against any other
   baseContentHash: string;      // sha256 of the base this entry was trained/verified against
 }
@@ -119,6 +141,50 @@ export interface Lifecycle {
   };
 }
 
+/**
+ * Egress manifest (forensic: ChatGPT client fans telemetry out through a first-party
+ * /ces gateway to Statsig + Datadog, undeclared to the user).
+ * SourceOS keeps the single-gateway pattern but every target is DECLARED here and
+ * admitted by guardrail-fabric. No component may egress to a host not in this list.
+ *
+ * permittedPhases closes the bootstrap-egress gap: a target declared as
+ * inference-only cannot contact the network during bootstrap or shutdown.
+ */
+export interface EgressManifest {
+  targets: Array<{
+    host: string;               // e.g. "evidence.sourceos.internal"
+    purpose: "telemetry" | "provenance" | "experimentation" | "inference" | "feedback";
+    processor: string;          // who actually receives it (first- or third-party), named
+    wire: CarryWire;
+    // Explicit phases this target may be contacted. Absent = no egress in that phase.
+    // bootstrap egress requires explicit justification (audit trigger).
+    permittedPhases: ExecutionPhase[];
+  }>;
+  // If false, the entry asserts it performs no network egress at all.
+  permitsEgress: boolean;
+}
+
+/**
+ * Observability surface (forensic: the entry.client bootstrap installs the telemetry
+ * sink and reads feature flags BEFORE the first frame; sentinel gates the send path via
+ * chat-requirements/{prepare,finalize} BEFORE model IO — both silently).
+ * SourceOS mirrors the ordering but inverts the silence: the provenance sink and the
+ * policy read MUST initialize before any inference is reachable, and every emission and
+ * every gate verdict is surfaced rather than hidden.
+ */
+export interface ObservabilitySurface {
+  provenanceSinkRef: string;    // agentplane evidence sink this entry emits to
+  // What the entry emits as first-class, surfaced events (not silent instrumentation).
+  emits: Array<"timing" | "error" | "feature_activation" | "steering_diff" | "gate_verdict">;
+  // Bootstrap-ordering invariant (the entry.client lesson). Enforced at load:
+  // the sink + policy read come up before model IO is reachable. No unobserved window.
+  // Typed as literal true — false is structurally invalid and admission-denied.
+  sinkInitializesBeforeIO: true;
+  // Action-gate-before-IO (the sentinel/chat-requirements lesson). When true, a
+  // guardrail-fabric admission must clear before inference — and its verdict is emitted.
+  gatedBeforeIO: boolean;
+}
+
 // ── Top-level entry ─────────────────────────────────────────────────────────
 
 export interface ModelCatalogEntry {
@@ -129,7 +195,7 @@ export interface ModelCatalogEntry {
   kind: ArtifactKind;
 
   // Carry
-  baseBinding: BaseBinding;     // omit baseModelId only when kind === "base"
+  baseBinding: BaseBinding;     // baseModelId optional for kind="base"; required otherwise
   artifact: ArtifactRef;
 
   // SourceOS-distinct surfaces (strictly more than Apple's {weights, adapter, hash})
@@ -141,6 +207,16 @@ export interface ModelCatalogEntry {
   attestation: Attestation;
   evaluation: EvaluationRecord;
 
+  // What it emits and where it may egress (declared, surfaced, policy-admitted)
+  observability: ObservabilitySurface;
+  egress: EgressManifest;
+
+  // Cluster-level admission cross-reference.
+  // When set, must be a non-empty Triune admission-pack reference (pack_id or URI).
+  // An explicitly empty string triggers cluster_not_admitted denial.
+  // Omit for synthetic/pre-cluster-admission entries.
+  clusterAdmissionRef?: string;
+
   // Operational
   lifecycle: Lifecycle;
   createdAt: string;            // RFC 3339
@@ -156,18 +232,25 @@ export type AdmissionDenialReason =
   | "capability_not_granted"
   | "missing_epistemic_label"
   | "epistemic_rejected"
-  | "steering_diff_unsupported"; // entry claims steering but can't emit the diff
+  | "steering_diff_unsupported"    // entry claims steering but can't emit the diff
+  | "egress_target_not_permitted"  // permitsEgress=true but a target lacks permittedPhases
+  | "observability_sink_uninitialized" // sinkInitializesBeforeIO is not true
+  | "cluster_not_admitted";        // clusterAdmissionRef is explicitly empty
 
 export interface AdmissionResult {
   admitted: boolean;
   entryId: string;
   denials: AdmissionDenialReason[];   // empty iff admitted
-  evidenceRef?: string;               // agentplane provenance URI for the admission decision
+  evidenceRef: string;                // always emitted — denied results get a denial URI
+  // Triune cluster admission pack that admitted the node this entry runs on.
+  // Present when the entry carries a clusterAdmissionRef and admission passed.
+  clusterAdmissionRef?: string;
 }
 
 /**
  * Reference admission contract. Implementation lives in model-router; guardrail-fabric
  * owns the capability/policy verdict. Every check here is a hard gate — a single failure
- * denies. The decision itself is emitted as provenance (no silent admission).
+ * denies. The decision itself is always emitted as provenance (no silent admission or
+ * silent denial — AdmissionResult is written to the agentplane sink regardless of outcome).
  */
 export type AdmitEntry = (entry: ModelCatalogEntry) => Promise<AdmissionResult>;

examples/model-catalog-entry.admitted.json

@@ -48,6 +48,16 @@
     "epistemicLevel": "empirical",
     "evaluatedAt": "2026-06-10T00:00:00Z"
   },
+  "observability": {
+    "provenanceSinkRef": "agentplane:evidence-sink:sourceos.adapter.summarize.v1",
+    "emits": ["timing", "error", "gate_verdict"],
+    "sinkInitializesBeforeIO": true,
+    "gatedBeforeIO": true
+  },
+  "egress": {
+    "permitsEgress": false,
+    "targets": []
+  },
   "lifecycle": {
     "installManifest": {
       "placements": ["/var/sourceos/adapters/summarize.v1.0.0/"],

examples/model-catalog-entry.denied.epistemic-rejected.json

@@ -44,6 +44,16 @@
     "epistemicLevel": "rejected",
     "evaluatedAt": "2026-06-01T00:00:00Z"
   },
+  "observability": {
+    "provenanceSinkRef": "agentplane:evidence-sink:sourceos.adapter.summarize.v0-failed-eval",
+    "emits": ["timing", "error"],
+    "sinkInitializesBeforeIO": true,
+    "gatedBeforeIO": false
+  },
+  "egress": {
+    "permitsEgress": false,
+    "targets": []
+  },
   "lifecycle": {
     "installManifest": {
       "placements": ["/var/sourceos/adapters/summarize.v0.9.0/"],

examples/model-catalog-entry.denied.steering-diff-unsupported.json

@@ -48,6 +48,16 @@
     "epistemicLevel": "empirical",
     "evaluatedAt": "2026-06-10T00:00:00Z"
   },
+  "observability": {
+    "provenanceSinkRef": "agentplane:evidence-sink:sourceos.steering.concept-suppressor.v1",
+    "emits": ["timing", "error", "steering_diff"],
+    "sinkInitializesBeforeIO": true,
+    "gatedBeforeIO": true
+  },
+  "egress": {
+    "permitsEgress": false,
+    "targets": []
+  },
   "lifecycle": {
     "installManifest": {
       "placements": ["/var/sourceos/steering/concept-suppressor.v1.0.0/"],

examples/model-catalog-entry.noetica-chat.synthetic.json

@@ -0,0 +1,118 @@
+{
+  "_comment": "Synthetic fixture: Noetica Chat Surface M2a as a model-catalog-entry workload candidate. epistemicLevel=synthetic; clusterAdmissionRef is pending Triune admission pack. This fixture is NOT proof of live deployment or live Triune cluster membership.",
+  "id": "noetica.chat.m2a",
+  "version": "m2a.0.1.0",
+  "displayName": "Noetica Chat Surface M2a",
+  "kind": "base",
+  "baseBinding": {
+    "baseVersion": "m2a.0.1.0",
+    "baseContentHash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+  },
+  "artifact": {
+    "contentHash": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+    "sizeBytes": 10485760,
+    "encoding": "tritpack243",
+    "encrypted": true,
+    "wire": "tritrpc"
+  },
+  "interpretability": {
+    "steeringTier": "full",
+    "emitsSteeringDiff": true,
+    "saeFeatureDictRef": "neuronpedia:feature-dict:noetica-m2a:pending-evidence",
+    "steeringVectors": []
+  },
+  "governance": {
+    "guardrailPolicyRef": "guardrail-fabric:policy:noetica-chat-safe-v1",
+    "ontologyRef": "ontogenesis:chat-surface:v1"
+  },
+  "capability": {
+    "declaredCapabilities": [
+      "inference.text",
+      "net.egress:anthropic",
+      "net.egress:openai",
+      "net.egress:neuronpedia",
+      "net.egress:superconscious"
+    ],
+    "requiredPermissions": [
+      "net.egress:api.anthropic.com",
+      "net.egress:api.openai.com",
+      "net.egress:neuronpedia",
+      "net.egress:superconscious"
+    ],
+    "highPrivilege": true
+  },
+  "attestation": {
+    "signer": "sourceos.release.authority",
+    "signature": "3045022100synthetic-noetica-m2a-attestation-placeholder-not-a-real-signature",
+    "hashChain": [
+      "noetica.chat.m2a",
+      "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+      "guardrail-fabric:policy:noetica-chat-safe-v1",
+      "tritrpc://sourceos.artifacts/noetica/chat.m2a.0.1.0.pack"
+    ],
+    "hardenedRuntime": true
+  },
+  "evaluation": {
+    "evalFabricRunRef": "eval-fabric:run:noetica-m2a-synthetic:pending-live-eval",
+    "epistemicLevel": "synthetic",
+    "evaluatedAt": "2026-06-11T00:00:00Z"
+  },
+  "observability": {
+    "provenanceSinkRef": "agentplane:evidence-sink:noetica.chat.m2a",
+    "emits": ["timing", "error", "feature_activation", "steering_diff", "gate_verdict"],
+    "sinkInitializesBeforeIO": true,
+    "gatedBeforeIO": true
+  },
+  "egress": {
+    "permitsEgress": true,
+    "targets": [
+      {
+        "host": "api.anthropic.com",
+        "purpose": "inference",
+        "processor": "Anthropic PBC (first-party model provider)",
+        "wire": "https-fallback",
+        "permittedPhases": ["inference"]
+      },
+      {
+        "host": "api.openai.com",
+        "purpose": "inference",
+        "processor": "OpenAI LLC (first-party model provider)",
+        "wire": "https-fallback",
+        "permittedPhases": ["inference"]
+      },
+      {
+        "host": "neuronpedia",
+        "purpose": "experimentation",
+        "processor": "Neuronpedia (SAE feature steering; may be localhost agent-machine stub)",
+        "wire": "tritrpc",
+        "permittedPhases": ["inference"]
+      },
+      {
+        "host": "superconscious",
+        "purpose": "provenance",
+        "processor": "SourceOS Superconscious (task submission and evidence relay)",
+        "wire": "tritrpc",
+        "permittedPhases": ["inference", "shutdown"]
+      }
+    ]
+  },
+  "clusterAdmissionRef": "pending:triune-admission-pack-noetica-chat-m2a",
+  "lifecycle": {
+    "installManifest": {
+      "placements": [
+        "/var/sourceos/workloads/noetica/chat.m2a.0.1.0/",
+        "/etc/sourceos/noetica/config/"
+      ],
+      "registryRows": [
+        "model-router:workloads:noetica.chat.m2a",
+        "model-router:egress-grants:noetica.chat.m2a"
+      ]
+    },
+    "retentionPolicy": {
+      "keepVersions": 2,
+      "reapOrphanRows": true
+    }
+  },
+  "createdAt": "2026-06-11T00:00:00Z",
+  "sourceCommit": "pending"
+}

schemas/agent-machine-route-binding.schema.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.socioprophet.ai/model-router/agent-machine-route-binding.schema.json",
+  "title": "AgentMachineRouteBinding",
+  "description": "Model-router binding that links SourceOSModelCarryRef, ModelResidency, PlacementFact, and AgentMachineReceipt references into a governed local Agent Machine route.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "kind",
+    "bindingId",
+    "taskClass",
+    "sourceosModelCarryRef",
+    "runtimeRefs",
+    "routePolicy",
+    "evidence"
+  ],
+  "properties": {
+    "schemaVersion": { "const": "v0.1" },
+    "kind": { "const": "AgentMachineRouteBinding" },
+    "bindingId": { "type": "string", "pattern": "^urn:socioprophet:model-router:agent-machine-binding:" },
+    "taskClass": { "type": "string", "enum": ["router", "triage", "summarization", "rewrite", "office-assist", "agent-machine-assist", "offline-fallback", "coding-assist", "privacy-first-chat", "complex-reasoning"] },
+    "sourceosModelCarryRef": { "type": "string", "pattern": "^urn:srcos:model-carry-ref:" },
+    "runtimeRefs": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["inferenceProviderRef", "placementFactRef"],
+      "properties": {
+        "inferenceProviderRef": { "type": "string", "pattern": "^urn:srcos:inference-provider:" },
+        "modelResidencyRef": { "type": ["string", "null"], "pattern": "^urn:srcos:model-residency:" },
+        "placementFactRef": { "type": "string", "pattern": "^urn:srcos:placement-fact:" },
+        "lastAgentMachineReceiptRef": { "type": ["string", "null"], "pattern": "^urn:srcos:agent-machine-receipt:" }
+      }
+    },
+    "routePolicy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["localFirst", "requiresPolicyDecision", "promptEgress", "hostedFallbackAllowed", "cacheReuseRequiresPolicy"],
+      "properties": {
+        "localFirst": { "type": "boolean", "const": true },
+        "requiresPolicyDecision": { "type": "boolean", "const": true },
+        "promptEgress": { "type": "string", "enum": ["deny", "allow-with-policy"] },
+        "hostedFallbackAllowed": { "type": "boolean" },
+        "cacheReuseRequiresPolicy": { "type": "boolean", "const": true },
+        "minimumResidencyState": { "type": "string", "enum": ["cached", "loaded-cold", "loaded-warm", "pinned"] }
+      }
+    },
+    "evidence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["emitRouteDecision", "emitPlacementFactRef", "emitAgentMachineReceiptRef", "promptHashOnly"],
+      "properties": {
+        "emitRouteDecision": { "type": "boolean", "const": true },
+        "emitPlacementFactRef": { "type": "boolean", "const": true },
+        "emitAgentMachineReceiptRef": { "type": "boolean", "const": true },
+        "promptHashOnly": { "type": "boolean", "const": true },
+        "ledgerRef": { "type": "string" }
+      }
+    }
+  }
+}